eve 0.66.2 → 0.67.0

package/docs/agent-config.md

@@ -18,7 +18,7 @@ export default defineAgent({
 ```
 
 For a static AI Gateway model ID, you can make the same source change from the
-project root with `eve set --model anthropic/claude-opus-5.5` or from the local
+project root with `eve set model anthropic/claude-opus-5.5` or from the local
 dev TUI with `/model anthropic/claude-opus-5.5`.
 
 The root `agent.ts` can be omitted when no runtime config is needed. eve then selects its default `agent.ts` source at the same slot, configured with `spacexai/grok-4.7`; authoring the file replaces that source.
@@ -133,7 +133,7 @@ A dynamic model selection can return `reasoning` alongside `model` to override
 the agent-level setting for that selection. Omitting it inherits the agent setting;
 `"provider-default"` explicitly uses the provider's default.
 
-Run `eve set --reasoning high` to update this field from the command line.
+Run `eve set model --reasoning high` to update this field from the command line.
 
 ## Compaction
 
@@ -191,8 +191,8 @@ could retry against a fresh quota share. A reply that answers neither option
 is queued while the existing prompt stays pending; eve does not raise another
 copy. The reply is processed once the budget is granted.
 
-Sessions that cannot reach a human — task-mode runs such as schedules and
-delegated runs without input proxying — skip the prompt and fail the next model
+Sessions that cannot request input from a human, such as markdown schedules and
+delegated runs without input proxying, skip the prompt and fail the next model
 call with `SESSION_TOKEN_LIMIT_REACHED` for token budgets or
 `SESSION_TOKEN_COST_LIMIT_REACHED` for model token cost. A delegated task with
 no inherited quota also fails instead of raising a continuation prompt that
@@ -328,15 +328,14 @@ it falls back to the World's default retention period.
 
 `defineAgent` takes a few more fields, all optional. For the exported types, see the [TypeScript API Reference](./reference/typescript-api).
 
-| Field          | Type                                    | Default          | Description                                                                                                                                                                                                                                               |
-| -------------- | --------------------------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `reasoning`    | `AgentReasoningDefinition`              | provider default | Provider-agnostic reasoning effort forwarded to the agent's turn model calls.                                                                                                                                                                             |
-| `modelOptions` | `AgentModelOptionsDefinition`           | none             | Provider option overrides forwarded to the model call.                                                                                                                                                                                                    |
-| `limits`       | `AgentLimitsDefinition`                 | field-specific   | Framework-owned runtime limits. Sessions complete after 30 days by default; usage-limit defaults and inheritance are described above. Set a limit to `false` to disable it.                                                                               |
-| `experimental` | `AgentExperimentalDefinition`           | unset            | Unstable opt-ins. `workflow.world` selects the Workflow world package on the root agent; `workflow.modelCallsPerStep` batches sequential model calls into a wider replay unit; `workflow.retention` controls how long the durable runtime keeps run data. |
-| `outputSchema` | Standard Schema or a JSON Schema object | none             | Structured return type for function-like invocations such as a subagent turn, schedule, or remote job. Ordinary interactive turns ignore it unless the client supplies a per-message schema.                                                              |
-| `build`        | `{ externalDependencies?: string[] }`   | none             | Hosted-build packaging controls. `externalDependencies` keeps listed packages external while eve compiles authored modules such as tools and channels, and traces those packages into the hosted output.                                                  |
-| `tool`         | `boolean`                               | `true`           | Exposes this agent to its parent model as a tool. On the root agent, controls the built-in `agent` tool. A subagent with `tool: false` remains callable from authored workflow tools through `ctx.agent()`.                                               |
+| Field          | Type                                  | Default          | Description                                                                                                                                                                                                                                               |
+| -------------- | ------------------------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `reasoning`    | `AgentReasoningDefinition`            | provider default | Provider-agnostic reasoning effort forwarded to the agent's turn model calls.                                                                                                                                                                             |
+| `modelOptions` | `AgentModelOptionsDefinition`         | none             | Provider option overrides forwarded to the model call.                                                                                                                                                                                                    |
+| `limits`       | `AgentLimitsDefinition`               | field-specific   | Framework-owned runtime limits. Sessions complete after 30 days by default; usage-limit defaults and inheritance are described above. Set a limit to `false` to disable it.                                                                               |
+| `experimental` | `AgentExperimentalDefinition`         | unset            | Unstable opt-ins. `workflow.world` selects the Workflow world package on the root agent; `workflow.modelCallsPerStep` batches sequential model calls into a wider replay unit; `workflow.retention` controls how long the durable runtime keeps run data. |
+| `build`        | `{ externalDependencies?: string[] }` | none             | Hosted-build packaging controls. `externalDependencies` keeps listed packages external while eve compiles authored modules such as tools and channels, and traces those packages into the hosted output.                                                  |
+| `tool`         | `boolean`                             | `true`           | Exposes this agent to its parent model as a tool. On the root agent, controls the built-in `agent` tool. A subagent with `tool: false` remains callable from authored workflow tools through `ctx.agent()`.                                               |
 
 `externalDependencies` is a packaging control only. It keeps selected packages as runtime dependencies in the hosted output; it does not authorize, configure, or review any third-party service those packages may call.
 

package/docs/channels/chat-sdk.mdx

@@ -104,7 +104,7 @@ bot.onNewMention(async (thread, message) => {
 });
 ```
 
-`options` accepts `{ thread, auth?, title?, mode?, callback?, adapterName?, turnPolicy? }`. `title` sets the eve session's display title without changing the model message; `auth` attaches an authenticated principal to the turn.
+`options` accepts `{ thread, auth?, title?, callback?, adapterName?, turnPolicy? }`. `title` sets the eve session's display title without changing the model message; `auth` attaches an authenticated principal to the turn.
 
 ### Steering
 

package/docs/channels/custom.mdx

@@ -334,7 +334,7 @@ export default defineChannel({
 });
 ```
 
-The input contains the channel's `state`, `caller`, `channel`, `mode`, and `environment`. A principal caller omits `principalId`, `issuer`, and `subject`, but its `attributes` come from route auth and can still contain identifying values. Return `"public"`, `"private"`, or `"unknown"`. Return `"unknown"` when the channel does not have enough evidence to classify confidently; consumers treat it as non-public. A missing, throwing, asynchronous, or malformed classifier also fails closed to `"unknown"`.
+The input contains the channel's `state`, `caller`, `channel`, and `environment`. A principal caller omits `principalId`, `issuer`, and `subject`, but its `attributes` come from route auth and can still contain identifying values. Return `"public"`, `"private"`, or `"unknown"`. Return `"unknown"` when the channel does not have enough evidence to classify confidently; consumers treat it as non-public. A missing, throwing, asynchronous, or malformed classifier also fails closed to `"unknown"`.
 
 When you explicitly annotate a callback, use `AudienceContext<TState>`. `AudienceInput<TState>` remains supported for existing callbacks while you migrate.
 

package/docs/channels/eve.mdx

@@ -49,8 +49,8 @@ See [Start a session](../concepts/sessions-runs-and-streaming#start-a-session) f
 initialization boundary, first-turn identity, readiness response, and retry behavior.
 
 The create request still requires route auth. Session audience and the timeout are selected
-at creation; they do not change when the first message arrives. Task mode and turn-scoped
-fields such as `clientContext` and `outputSchema` require a message on the create request.
+at creation; they do not change when the first message arrives. Turn-scoped fields such as
+`clientContext` and `outputSchema` require a message on the create request.
 
 Include an initial message to create the session and start its first turn in one request:
 
@@ -200,8 +200,8 @@ call the endpoint. `auth` still controls access. For a classification that
 depends on channel state or application-specific verified data, use a [custom
 channel audience](./custom#conversation-audience).
 
-You can also pass a function that receives `caller`, channel, run mode, and
-deployment environment. Classification is fixed at session creation, so a later
+You can also pass a function that receives `caller`, channel, and deployment
+environment. Classification is fixed at session creation, so a later
 turn from a different caller does not reclassify the session.
 
 For a remote agent, a trusted dispatch can forward the original audience and

package/docs/channels/mcp.mdx

@@ -168,7 +168,7 @@ MCP clients receive four tools:
 
 | Tool           | Input                         | Purpose                                                     |
 | -------------- | ----------------------------- | ----------------------------------------------------------- |
-| `agent_start`  | `{ message, outputSchema? }`  | Start durable work and immediately return an invocation ID. |
+| `agent_start`  | `{ message }`                 | Start durable work and immediately return an invocation ID. |
 | `agent_get`    | `{ invocationId }`            | Read the invocation's complete current state.               |
 | `agent_update` | `{ invocationId, responses }` | Answer the complete pending human-input batch.              |
 | `agent_cancel` | `{ invocationId }`            | Request cooperative cancellation of non-terminal work.      |
@@ -177,7 +177,7 @@ The server also returns `instructions` from `initialize` and `server/discover` t
 protocol for the connecting model, so a hosted client does not have to infer it from the tool
 schemas alone.
 
-`agent_start` creates one task-mode eve session and returns after durable acceptance without
+`agent_start` creates one eve session and returns after durable acceptance without
 waiting for the session continuation hook to become readable. Keep its `invocationId`, then call
 `agent_get` until the invocation reaches a terminal state. While the status is `working`, wait at
 least `pollAfterMs` before polling again.
@@ -187,22 +187,22 @@ The invocation response is discriminated by `status`:
 - `working`: work is active; continue polling according to `pollAfterMs`.
 - `input_required`: present `inputRequests`, then send the complete answer batch through `agent_update`. A successful update returns the current invocation state.
 - `authorization_required`: present the returned sign-in URL, user code, or instructions. The connection callback resumes the invocation automatically; continue polling.
-- `completed`: consume the optional `result`.
+- `completed`: the agent's turn settled. Consume the optional `result`: the final assistant message.
 - `failed`: inspect the structured `error`.
 - `cancelled`: cancellation reached a terminal state.
 
 A tool result with `isError: true` means the call itself was rejected. A `failed` status means the call succeeded and the task itself failed. Handle them differently: correct the call in the first case, report the task failure in the second. Rejected calls carry `structuredContent.error` with a stable `code`, a short `message`, and `retryable`:
 
-| `code`          | Meaning                                                                        | `retryable` |
-| --------------- | ------------------------------------------------------------------------------ | ----------- |
-| `invalid_input` | An argument was rejected, for example an oversized or external `outputSchema`. | `false`     |
-| `not_found`     | The invocation does not exist, has expired, or belongs to another caller.      | `false`     |
-| `conflict`      | The invocation is not in the expected state; read it with `agent_get` first.   | `true`      |
-| `internal`      | eve failed; `errorId` correlates with server logs. No details are exposed.     | `false`     |
+| `code`          | Meaning                                                                      | `retryable` |
+| --------------- | ---------------------------------------------------------------------------- | ----------- |
+| `invalid_input` | An argument was rejected, for example an oversized `message`.                | `false`     |
+| `not_found`     | The invocation does not exist, has expired, or belongs to another caller.    | `false`     |
+| `conflict`      | The invocation is not in the expected state; read it with `agent_get` first. | `true`      |
+| `internal`      | eve failed; `errorId` correlates with server logs. No details are exposed.   | `false`     |
 
 Cancellation is cooperative, so call `agent_get` after `agent_cancel` until the state becomes terminal.
 
-Requests are bounded: the whole MCP request body is limited to 1 MiB, `message` to 64 KiB, each input-response `text` to 16 KiB (both measured as UTF-8 bytes, not characters), and one `agent_update` to 64 responses. Optional output schemas are limited to 64 KiB, 32 levels, and 2,048 nodes, and external `$ref` values are rejected. Oversized bodies receive a JSON-RPC `413`; oversized fields fail input validation before any work starts.
+Requests are bounded: the whole MCP request body is limited to 1 MiB, `message` to 64 KiB, each input-response `text` to 16 KiB (both measured as UTF-8 bytes, not characters), and one `agent_update` to 64 responses. Oversized bodies receive a JSON-RPC `413`; oversized fields fail input validation before any work starts.
 
 ### Durability guarantees
 

package/docs/channels/slack.mdx

@@ -187,7 +187,7 @@ export default slackChannel({
 
 The model-visible `<slack_message>` includes `sender_id`, `bot_user_id` when available, and the `is_mentioned` value from `ctx.isBotMentioned()`. Its `<content>` keeps `<@USER_ID>` intact while converting other mrkdwn to Markdown; routing is unchanged.
 
-When a Slack message shares another Slack message, eve extracts the forwarded message body from Slack's message-unfurl attachment and includes it in `<content>`. The original top-level comment, when present, remains alongside the forwarded content.
+When a Slack message includes a link preview, eve includes its attachment text in `<content>` alongside the sender's message, including when the link has words around it. Shared Slack messages work the same way: eve extracts the forwarded message body from Slack's message-unfurl attachment and keeps any top-level comment.
 
 #### Restrict who can invoke the agent
 
@@ -407,6 +407,7 @@ import { connectSlackCredentials } from "@vercel/connect/eve";
 
 const { botToken } = connectSlackCredentials("slack/my-agent");
 const response = await callSlackApi({
+  api: { apiBaseUrl: process.env.SLACK_API_BASE_URL },
   botToken,
   context: { teamId: "T0123456789" },
   operation: "reactions.get",
@@ -418,8 +419,34 @@ if (!response.ok) throw new Error(String(response.error));
 `callSlackApi` resolves function-form tokens (secret managers, Connect
 rotation) with the supplied `context` at call time and form-encodes the body — the only safe default,
 since Slack's JSON support is partial (`conversations.replies` rejects
-JSON). `resolveSlackBotToken` materializes a `SlackBotToken` to a string
-when you need the bearer token itself.
+JSON). It takes the same
+[`api`](#point-the-channel-at-a-different-slack-api-host) the channel takes, checked and
+confined the same way, so a call made without a channel carries the same guarantees. An
+`apiBaseUrl` of `undefined` keeps Slack's own host.
+
+`resolveSlackBotToken` materializes a `SlackBotToken` to a string when you need the
+bearer token itself.
+
+### Point the channel at a different Slack API host
+
+```ts
+slackChannel({
+  api: {
+    apiBaseUrl: "https://slack-simulator.example/api/slack",
+    fetch: (input, init) => {
+      const headers = new Headers(init?.headers);
+      headers.set("x-vercel-protection-bypass", process.env.SLACK_SIMULATOR_BYPASS_SECRET ?? "");
+      return fetch(input, { ...init, headers });
+    },
+    fileBaseUrl: "https://slack-simulator.example/files",
+  },
+  credentials: { botToken: process.env.SLACK_BOT_TOKEN },
+});
+```
+
+The bases say where a call may go. `apiBaseUrl` is the base Slack Web API method names resolve against, and defaults to `https://slack.com/api/`. `fileBaseUrl` adds a base for attachment downloads and falls back to `apiBaseUrl`: a download URL under it is fetched with the bot token, in addition to `files.slack.com` and Enterprise Grid file URLs. Every other URL passes through to the model provider unchanged. Both bases must be absolute `http:` or `https:` URLs carrying no query string or fragment; `slackChannel()` throws on one that is not, naming the option. A missing trailing slash is added, so `https://sim.example/api` sends `chat.postMessage` to `https://sim.example/api/chat.postMessage`.
+
+`api.fetch` says how the traffic travels. It replaces the global `fetch` for calls to the configured bases — use it to attach the per-call header a host behind an authenticating proxy requires, as the example does for a simulator behind Vercel Deployment Protection. eve confines it to those bases' origins, so that header reaches the simulator alone: `files.slack.com`, and any other host Slack names in a response or an inbound payload, keep the global `fetch`. A wrapper therefore attaches its credential unconditionally. With no base configured every call already goes to Slack's own hosts, and `api.fetch` carries all of them, which is what observes or stubs the traffic in a test.
 
 ### Delivery
 
@@ -521,6 +548,8 @@ Inbound files behind authenticated Slack URLs are staged with `fetchFile`. See [
 
 Private file downloads resolve credentials from the session's app installation workspace and require the Slack bot token's `files:read` scope. Add the scope and reinstall the Slack app before sending attachments.
 
+Downloads cover Slack's own file hosts plus URLs under a configured [`api.fileBaseUrl`](#point-the-channel-at-a-different-slack-api-host), and travel on `api.fetch` when one is configured.
+
 Staged files live in the session sandbox under `/workspace/attachments`. Session history keeps a reference to that path, not a second copy of the Slack file. If the backend can no longer reattach the original sandbox, eve cannot restore the attachment bytes from history; later turns receive a missing-file result. Store files outside the sandbox when the agent must retain them independently of sandbox availability.
 
 ## What to read next

package/docs/concepts/sessions-runs-and-streaming.md

@@ -41,8 +41,8 @@ curl -X POST http://127.0.0.1:2000/eve/v1/session
 
 eve starts the durable workflow, establishes its inbox, and waits for the first message before
 running session-scoped initialization or emitting `session.started`. The first message sent to the returned
-`sessionId` remains `turn_0`. Message-free creation supports conversation mode only and does not
-accept turn-scoped `clientContext`, `outputSchema`, callbacks, or activity observers.
+`sessionId` remains `turn_0`. Message-free creation does not accept turn-scoped `clientContext`,
+`outputSchema`, callbacks, or activity observers.
 
 To create the session and start its first turn in one request, include the message:
 
@@ -86,8 +86,8 @@ The stream is newline-delimited JSON (NDJSON), one event per line:
 | `message.appended`        | An assistant text delta.                                                                                                                           |
 | `message.completed`       | A finalized assistant text block.                                                                                                                  |
 | `result.completed`        | The finalized structured result for a turn that requested an output schema; carries `result`.                                                      |
-| `compaction.requested`    | Context-window compaction began; carries `modelId`, `sessionId`, `turnId`, `usageInputTokens`.                                                     |
-| `compaction.completed`    | A compaction checkpoint was written to durable history.                                                                                            |
+| `compaction.requested`    | Context-window compaction began; carries `modelId`, `sessionId`, `turnId`, `stepIndex`, and `usageInputTokens`.                                    |
+| `compaction.completed`    | A compaction checkpoint was written to durable history; carries the same model, session, turn, and step identity.                                  |
 | `authorization.required`  | A connection needs OAuth; carries `name`, `description`, and an `authorization` challenge.                                                         |
 | `authorization.completed` | A connection's authorization resolved; carries `outcome`.                                                                                          |
 | `step.completed`          | A model step finished; carries `finishReason` and usage.                                                                                           |
@@ -128,8 +128,7 @@ A provider response ending with `content-filter` fails with `MODEL_CALL_FAILED`,
 `details.finishReason: "content-filter"`. Details also include the Gateway
 `generationId` when available. eve does not retry the filtered response or emit
 `message.completed` for its partial text; deltas already streamed remain visible.
-Conversation sessions wait for another user message, while task-mode runs return
-a failed result.
+The session then waits for another user message.
 
 ## The event envelope
 

package/docs/connections/overview.mdx

@@ -58,6 +58,28 @@ must also set `instanceKey` to a stable, non-secret account or tenant identifier
 See [Dynamic capabilities](/docs/guides/dynamic-capabilities#dynamic-connections)
 for event scope, naming, conflicts, and durable recovery behavior.
 
+Tools from a `turn.started` connection can require approval, including an
+`approval.response` policy. When an approval resumes between turns, eve rebuilds
+the connection callbacks before checking the response policy, even in a fresh
+process. This restoration uses the pending request's turn coordinates and the
+current authenticated session context; it does not emit another public
+`turn.started` event. The response policy still receives the authenticated
+responder separately. When one delivery answers requests from different turns,
+eve restores each candidate's originating connection scope before its policy
+check, then prepares the complete batch selected for tool replay. Keep connection
+resolvers idempotent because restoration can run them again.
+
+Restoration uses current resolver results, not a historical connection snapshot.
+If the tool is absent from the persisted tool metadata, or its required response
+policy is unavailable, eve refuses the response and leaves the request pending.
+eve does not reconstruct missing tool metadata from earlier turns. Before replay, eve checks that the
+approved tool is still available and that its connection identity has not
+changed since the call requested approval. A missing or changed connection
+fails the replay rather than sending the call to a replacement destination.
+Request a new tool call and approval after correcting the connection. Identity
+includes the endpoint and `instanceKey`; use a distinct `instanceKey` for each
+account or tenant even when they share an endpoint.
+
 ## Static-token auth
 
 `getToken` returns a `TokenResult` (`{ token, expiresAt? }`), and eve sends it as `Authorization: Bearer <token>` on every request. Because it runs on each connection attempt, you can mint a fresh token from wherever you keep secrets, including an env var, a secrets manager, an internal vault, or your own OAuth exchange:

package/docs/guides/deployment/overview.md

@@ -47,7 +47,7 @@ curl https://your_agent.example.com/eve/v1/health
 Then connect the development terminal user interface (TUI) to the deployment and send a real message:
 
 ```bash
-eve dev https://your_agent.example.com
+eve remote connect --url https://your_agent.example.com
 ```
 
 Set `VERCEL_AUTOMATION_BYPASS_SECRET` locally first if a Vercel deployment uses Deployment Protection.

package/docs/guides/deployment/self-hosting.md

@@ -116,7 +116,7 @@ curl https://your_agent.example.com/eve/v1/health
 Then connect the development TUI and complete a real turn:
 
 ```bash
-eve dev https://your_agent.example.com
+eve remote connect --url https://your_agent.example.com
 ```
 
 ## Continue configuring production

package/docs/guides/deployment/vercel.mdx

@@ -143,14 +143,14 @@ For a single unnamed agent, check the health route and connect the development T
 
 ```bash
 curl https://your_agent.vercel.app/eve/v1/health
-eve dev https://your_agent.vercel.app
+eve remote connect --url https://your_agent.vercel.app
 ```
 
 For a workspace agent, include its public `/eve/<name>` mount. For example:
 
 ```bash
 curl https://your_agent.vercel.app/eve/support/v1/health
-eve dev https://your_agent.vercel.app/eve/support
+eve remote connect --url https://your_agent.vercel.app/eve/support
 ```
 
 Set `VERCEL_AUTOMATION_BYPASS_SECRET` locally before connecting if the deployment uses Deployment Protection.

package/docs/guides/dev-tui.md

@@ -31,7 +31,7 @@ The transcript remains in your terminal scrollback after you exit. Run `/help` i
 | `/help`     | List available commands.                                                                                                                                     |
 | `/exit`     | Quit the UI.                                                                                                                                                 |
 
-`/login`, `/model`, `/add`, `/deploy`, `/info`, and `/traces` are available when `eve dev` runs locally. They are unavailable when the UI connects to a server with `--url`.
+`/login`, `/model`, `/add`, `/deploy`, `/info`, and `/traces` are available when `eve dev` runs locally. They are unavailable when the UI connects through `eve remote connect`.
 
 ## Set up a new agent
 
@@ -86,7 +86,7 @@ Pass an item address to install it directly:
 /add @acme/analytics
 ```
 
-Required authorization or deployment setup still runs for the selected item. Press `Esc` to cancel setup; files already installed remain in the project.
+Required authorization or deployment setup still runs for the selected item. Press `Esc` to cancel setup; files already installed remain in the project. If dependency installation fails, retry the `eve add` command in a terminal for details; raw installer output is not captured in the TUI.
 
 ## Work with the agent
 
@@ -131,19 +131,19 @@ Use `--host` and `--port` to bind the local server, or `--no-ui` to run without
 Pass a URL to use the terminal UI with an existing eve server instead of starting one locally:
 
 ```bash
-eve dev https://your-app.vercel.app
+eve remote connect --url https://your-app.vercel.app
 ```
 
-The URL form is shorthand for `--url`. To send credentials or custom request headers, use a URL with HTTP Basic credentials or repeat `-H, --header`:
+Use `eve remote connect` for an existing agent. To send credentials or custom request headers, use a URL with HTTP Basic credentials or repeat `-H, --header`:
 
 ```bash
-eve dev https://user:pass@your-app.example.com
-eve dev https://your-app.example.com -H 'Authorization: Bearer your_token_here'
+eve remote connect --url https://user:pass@your-app.example.com
+eve remote connect --url https://your-app.example.com -H 'Authorization: Bearer your_token_here'
 ```
 
 Remote Vercel sessions reuse an existing authorized CLI session. They do not open an account login flow or modify the local project's Vercel link or `.env.local`.
 
-When Deployment Protection blocks startup, eve verifies the target project and asks before adding a Trusted Sources rule for development access to that deployment's environment. After approval, eve applies the rule and checks access again before returning to chat. Cancelling preserves your draft; restart `eve dev <url>` to try again. If you cannot change the project's policy, provide `VERCEL_AUTOMATION_BYPASS_SECRET` or ask a project administrator to configure access in Deployment Protection settings.
+When Deployment Protection blocks startup, eve verifies the target project and asks before adding a Trusted Sources rule for development access to that deployment's environment. After approval, eve applies the rule and checks access again before returning to chat. Cancelling preserves your draft; restart `eve remote connect --url <url>` to try again. If you cannot change the project's policy, provide `VERCEL_AUTOMATION_BYPASS_SECRET` or ask a project administrator to configure access in Deployment Protection settings.
 
 ## What to read next
 

package/docs/guides/dynamic-capabilities.md

@@ -126,8 +126,8 @@ export default defineDynamic({
 });
 ```
 
-The returned remote definition can change its URL, path, headers, auth,
-principal forwarding, and output schema. Function-valued URLs resolve when the
+The returned remote definition can change its URL, path, headers, auth, and
+principal forwarding. Function-valued URLs resolve when the
 dynamic event runs. Auth and headers remain lazy and resolve before each
 outbound request without entering durable workflow state.
 

package/docs/guides/frontend/overview.mdx

@@ -229,8 +229,10 @@ const pendingRequests = agent.data.messages
     return request ? [request] : [];
   });
 
+const inputDisabled = ["submitted", "streaming", "resuming"].includes(agent.status);
+
 return pendingRequests.map((request) => (
-  <fieldset key={request.requestId}>
+  <fieldset disabled={inputDisabled} key={request.requestId}>
     <legend>
       {request.kind === "tool-approval"
         ? "Approval required"
@@ -252,7 +254,7 @@ return pendingRequests.map((request) => (
 ));
 ```
 
-For a question with `allowFreeform`, render a text input and send `{ requestId, text }`. The default reducer marks each matching part as responded immediately. Approved tools update again when eve streams their result.
+For a question with `allowFreeform`, render a text input and send `{ requestId, text }`. The default reducer keeps each request pending until the server confirms its resolution through `input.resolved` or `approval.settled`. Disable input controls while the response is being processed; a refused approval attempt leaves the request answerable. Approved tools update again when eve streams their result.
 
 ## Authorization prompts
 
@@ -348,7 +350,7 @@ const agent = useEveAgent({ reducer: toolCounter });
 // agent.data is ToolLog
 ```
 
-`reduce(data, event)` receives both authoritative eve stream events and client projection events (`client.message.submitted`, `client.message.failed`, `client.input.responded`). `client.input.responded` updates the submitting UI immediately; the durable `input.resolved` event later confirms the server-accepted outcome and lets replayed history rebuild the same HITL state. Return `data` unchanged for events your reducer does not handle.
+`reduce(data, event)` receives both authoritative eve stream events and client projection events (`client.message.submitted`, `client.message.failed`, `client.input.responded`). `client.input.responded` notifies custom reducers that an answer was submitted, not that it was accepted. The default reducer waits for server settlement; the durable `input.resolved` event records the server-accepted outcome and lets replayed history rebuild the same HITL state. Return `data` unchanged for events your reducer does not handle.
 
 ## Resumable sessions
 

package/docs/guides/hooks.md

@@ -181,14 +181,16 @@ Hooks always run after the event is durably recorded, so if a hook throws, the s
 
 ## What happens when a hook throws
 
-A thrown handler during a model turn propagates through turn execution and surfaces as `turn.failed`. In a conversation session, this includes handlers for `turn.started` and the first `step.started` of a model call: the failed turn ends with `session.waiting`, and the next message can start another turn. Task-mode boundary failures remain terminal. If a hook subscribed to a failure-cascade event also throws, it escalates to `session.failed`. For belt-and-suspenders semantics inside a hook, wrap the body in `try`/`catch`. eve treats a thrown hook as a real failure.
+A thrown handler during a model turn propagates through turn execution and surfaces as `turn.failed`. This includes handlers for `turn.started` and the first `step.started` of a model call: the failed turn ends with `session.waiting`, and the next message can start another turn. If a hook subscribed to a failure-cascade event also throws, it escalates to `session.failed`. For belt-and-suspenders semantics inside a hook, wrap the body in `try`/`catch`. eve treats a thrown hook as a real failure.
 
-For `subagent.called` and `subagent.completed`, a thrown handler fails the notification step and follows the workflow runtime's step retry policy. A retry can publish the event again before rerunning its hooks. Parent execution waits for the notification step to finish or exhaust its retries.
+For `subagent.called`, `subagent.completed`, and events proxied from a child, a thrown handler fails the publishing step and follows the workflow runtime's step retry policy. A retry can publish the event again before rerunning its hooks. Parent execution waits for the publishing step to finish or exhaust its retries. Exhausting retries fails the session.
 
 ## Subagent isolation
 
 Subagents may carry their own `agent/hooks/` directory. Subagent hooks fire only inside the subagent scope. Parent-agent hooks do not fire for subagent turns, and subagent hooks see only the subagent's own context.
 
+Interactive events such as `input.requested` and `authorization.required` are also published on the parent stream. Parent hooks observe these events after the parent channel handler and stream write, with the parent's session, agent, and channel context. The event retains the child's turn coordinates, so `event.data.turnId` can differ from `ctx.session.turn.id`. The accompanying parent `turn.completed` and `session.waiting` events also invoke parent hooks; they do not resolve pending input requests.
+
 ## Hook vs tool vs provider
 
 | Need                                              | Use                                            |

package/docs/guides/instrumentation/agent-runs.mdx

@@ -19,13 +19,6 @@ Agent Runs usage is billed at
 [Always-on Tracing rates](https://vercel.com/docs/tracing/always-on-tracing#usage-and-pricing)
 during beta. All plans include 30-day Agent Runs retention during beta.
 
-## Configure Agent Runs
-
-Preview and production deployments export to Vercel Agent Runs by default.
-Omitting `agent/instrumentation/agent-runs.ts` preserves that default. Export
-`agentRuns(...)` from that file to reconfigure it, or export
-`disableInstrumentation()` to disable it.
-
 ## Enable tracing on Vercel
 
 When `eve deploy` creates a new Vercel project, it configures 100% trace
@@ -47,6 +40,13 @@ Tracing starts as soon as you save the rule. You can also manage sampling
 rules with [`vercel traces config`](https://vercel.com/docs/cli/traces#manage-trace-sampling-rules).
 The CLI accepts rates from 1 to 100%; add a 0% rule from the dashboard.
 
+## Configure Agent Runs
+
+Preview and production deployments export to Vercel Agent Runs by default.
+Omit `agent/instrumentation/agent-runs.ts` to keep that default. To change it,
+default-export `agentRuns(...)` from that file, or default-export
+`disableInstrumentation()` to turn off Agent Runs export.
+
 ## Filter Agent Runs exports
 
 `agentRuns()` accepts one `exportPolicy` object or an array applied in order.

package/docs/guides/instrumentation/instrumentation.mdx

@@ -51,6 +51,11 @@ export default defineInstrumentation({
 `ctx.state` is JSON storage scoped to this file and operation. It survives
 durable suspension and is released after the terminal event.
 
+Use `setup` for asynchronous initialization. In `eve dev` and built servers,
+eve awaits every provider's setup before loading the server entry. A setup
+failure stops startup. Modules imported by an instrumentation file load before
+setup, so keep dependencies that need initialization out of those imports.
+
 ## Control inputs and outputs
 
 Each lifecycle file created with `defineInstrumentation(...)` has an
@@ -78,8 +83,8 @@ export default defineInstrumentation({
 });
 ```
 
-The function receives `agentName`, `channel`, `audience`, `mode`,
-`environment`, and `principalType`. `audience` is `"public"`, `"private"`, or
+The function receives `agentName`, `channel`, `audience`, `environment`, and
+`principalType`. `audience` is `"public"`, `"private"`, or
 `"unknown"`; `environment` is `"development"`, `"preview"`, or
 `"production"`.
 
@@ -146,9 +151,21 @@ Prefer `recordInputs: false` or `recordOutputs: false` when the destination does
 
 ## Lifecycle events
 
-Instrumentation can handle session, channel delivery, turn, model attempt,
-model call, action, input request, and tool call events. Start and terminal
-events share an `idempotencyKey`, which can serve as a destination row ID.
+`defineInstrumentation({ events })` supports the following event names. A
+start and its terminal event share an `idempotencyKey`; use it as a stable
+operation key when upserting records across replays.
+
+| Lifecycle        | Events                                                                                                            | Meaning                                                                                                                                                                          |
+| ---------------- | ----------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Session          | `session.started`, `session.waiting`, `session.completed`, `session.failed`                                       | Track a session from creation through suspension or termination. `session.waiting` is resumable; `session.completed` and `session.failed` are terminal.                          |
+| Turn             | `turn.started`, `turn.completed`, `turn.cancelled`, `turn.failed`                                                 | Track one turn. Cancellation is not a failure and commonly leaves the session waiting for another turn.                                                                          |
+| Channel delivery | `channel.delivery.started`, `channel.delivery.completed`, `channel.delivery.cancelled`, `channel.delivery.failed` | Track an inbound channel delivery while eve processes its turn. These events are emitted when the channel provides delivery metadata.                                            |
+| Step attempt     | `step.attempt.started`, `step.attempt.completed`, `step.attempt.failed`, `step.attempt.metadata`                  | Track each model-step attempt; retries have separate attempts. `step.attempt.metadata` is emitted after a step only when the AI SDK supplies provider metadata.                  |
+| Model call       | `model.call.started`, `model.call.completed`, `model.call.failed`                                                 | Track an individual call to the model provider. Completion includes usage and finish reason; content fields follow the trace policy.                                             |
+| Action           | `action.started`, `action.completed`, `action.failed`                                                             | Track eve's durable dispatch of a tool, skill load, local subagent, or remote agent. A failed event's `outcome` distinguishes failure, rejection, cancellation, and abandonment. |
+| Tool call        | `tool.call.started`, `tool.call.completed`, `tool.call.failed`                                                    | Track the AI SDK's in-process tool execution boundary, including its input and result when allowed by the trace policy.                                                          |
+| User input       | `input.requested`, `input.resolved`                                                                               | Track a question, tool approval, or session-limit request and its resolution. The resolution includes an outcome such as `answered`, `approved`, `denied`, or `cancelled`.       |
+| Memory operation | `memory.operation.started`, `memory.operation.completed`, `memory.operation.failed`                               | Track a memory-store search or write. Events include the operation name, phase, and memory slot; completion may include a record count and records.                              |
 
 An ordinary tool emits both `action.*` and `tool.call.*` events. Use `action.*` for eve's durable dispatch lifecycle, including tools, skills, subagents, and remote agents. Use `tool.call.*` only when you need the AI SDK's in-process tool execution boundary.
 

package/docs/guides/instrumentation/otel.mdx

@@ -38,6 +38,36 @@ does not affect lifecycle instrumentation created with `defineInstrumentation()`
 See [Audience](../channels/overview#audience) for how channels classify the
 conversation passed to this policy.
 
+## Instrument Node.js dependencies
+
+Pass OpenTelemetry instrumentation instances to `otel({ instrumentations })`.
+For example, install the PostgreSQL instrumentation alongside `pg`:
+
+```bash
+pnpm add pg @opentelemetry/instrumentation-pg
+```
+
+```ts title="agent/instrumentation/otel.ts"
+import { PgInstrumentation } from "@opentelemetry/instrumentation-pg";
+import { otel } from "eve/instrumentation/otel";
+
+export default otel({
+  instrumentations: [new PgInstrumentation()],
+});
+```
+
+Keep the instrumented package external so Node.js module hooks can intercept
+it. Add `pg` to your agent's [build configuration](/docs/agent-config#other-defineagent-fields):
+
+```ts title="agent/agent.ts"
+import { defineAgent } from "eve";
+
+export default defineAgent({
+  model: "openai/gpt-5.4-mini",
+  build: { externalDependencies: ["pg"] },
+});
+```
+
 ## Add an OpenTelemetry destination
 
 Use this section when sending traces to a third-party destination. Install

package/docs/guides/remote-agents.md

@@ -28,7 +28,6 @@ export default defineRemoteAgent({
 | `forwardPrincipal` | `boolean`                                     | No       | `false`           | Forward the dispatching turn's session principal to the remote deployment (see [Forwarding the caller identity](#forwarding-the-caller-identity)).       |
 | `headers`          | `HeadersValue`                                | No       | none              | Static or lazily resolved request headers.                                                                                                               |
 | `path`             | `string`                                      | No       | `/eve/v1/session` | Route appended to `url` for the create-session request.                                                                                                  |
-| `outputSchema`     | `StandardSchema \| JSON Schema`               | No       | none              | Structured return type for the first turn of each fresh remote session. A continuation may provide its own per-call schema.                              |
 | `tool`             | `boolean`                                     | No       | `true`            | Expose the remote agent as a tool to the parent model. Set `false` to allow only `ctx.agent()` calls from authored workflow tools.                       |
 
 ## Dynamic remote agents
@@ -81,9 +80,9 @@ The function may be async and must return a non-empty string. `auth` and `header
 
 ## Calling a remote agent
 
-By default, a remote agent is another subagent tool to the model. The model calls it the same way it calls a local subagent, with a `message` and an optional `outputSchema`. Set `tool: false` when an authored workflow tool should be the only model-facing routing surface; the workflow can still call the remote agent by its path-derived name through `ctx.agent()`. The message must carry the full task, including any context the remote agent needs, because it never receives the parent's conversation history.
+By default, a remote agent is another subagent tool to the model. The model calls it the same way it calls a local subagent, with a `message` and an optional `agentId`. Set `tool: false` when an authored workflow tool should be the only model-facing routing surface; the workflow can still call the remote agent by its path-derived name through `ctx.agent()`. The message must carry the full task, including any context the remote agent needs, because it never receives the parent's conversation history.
 
-To require structured output, set an `outputSchema` on the agent definition for fresh delegations or on an individual call for that turn. The structured value arrives in the task's completion notification, and the remote child remains available for follow-up messages. See [Subagents](../subagents) for continuation behavior.
+To require structured output, call the remote agent from an authored workflow tool with `ctx.agent(name, { message, outputSchema })`. The schema applies to that turn, the structured value is the call's result, and the remote child remains available for follow-up messages. See [Subagents](../subagents) for continuation behavior.
 
 ## Outbound auth
 
@@ -200,7 +199,7 @@ You can also steer a running remote background child by calling its subagent too
 
 When the parent session ends, eve sends an authenticated `POST /eve/v1/session/:childSessionId/reset` for each remote child. Reset retires the parked remote session and recursively cleans up its descendants. The request uses freshly resolved `headers` and `auth`; failures are logged so an unreachable remote cannot block parent finalization.
 
-A failed _start_ rejects admission before a task receipt is returned. After a remote starts, a terminal failure callback fails the task and notifies the parent with the remote's error (or `REMOTE_AGENT_FAILED` when none is supplied). Terminal callback delivery runs as a durable step on the underlying workflow engine (see [Execution model & durability](../concepts/execution-model-and-durability)). A failed callback POST is rethrown rather than marking the task complete, so the engine retries it.
+A failed _start_ rejects admission before a task receipt is returned. After a remote starts, a terminal failure callback fails the task and notifies the parent with the remote's error. Terminal callback delivery runs as a durable step on the underlying workflow engine (see [Execution model & durability](../concepts/execution-model-and-durability)). A failed callback POST is rethrown rather than marking the task complete, so the engine retries it.
 
 ## What to read next
 

package/docs/guides/self-modification.md

@@ -3,7 +3,7 @@ title: "Self-Modification"
 description: "Ask your agent to update its own instructions, tools, skills, and other authored files during local development."
 ---
 
-When `eve dev` starts a local server, it mounts the bundled self-modification extension by default. Ask your agent to change its instructions, tools, skills, or other files under `agent/`; eve delegates the source work to the `self-modification__agent` subagent. Connecting to an existing server with `eve dev <url>` does not add the bundled extension to that server.
+When `eve dev` starts a local server, it mounts the bundled self-modification extension by default. Ask your agent to change its instructions, tools, skills, or other files under `agent/`; eve delegates the source work to the `self-modification__agent` subagent. Connecting to an existing server with `eve remote connect --url <url>` does not add the bundled extension to that server.
 
 The bundled extension is for local development and is not included in production builds.
 

package/docs/memory/custom-provider.md

@@ -95,7 +95,7 @@ Every handler receives a `MemoryOperationContext`:
 | `memory.scope.value`     | The resolved scope string or tuple                                                                         |
 | `memory.slot`            | The path-derived slot name                                                                                 |
 | `messages`               | Projected conversation history for this phase                                                              |
-| `operationId`            | Stable per session, sequence, phase, and slot. Use it as an idempotency key.                               |
+| `operationId`            | Stable per session, turn, step, phase, and slot. Use it as an idempotency key.                             |
 | `abortSignal`            | Cancellation for the operation                                                                             |
 | `session`                | Session ID, authentication, and other `SessionContext` fields                                              |